registry / devplatform-ui-notification / 35.3.6

devplatform-ui-notification@35.3.6

visual components

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package silently starts a remote payload fetch and execution chain. It downloads an opaque platform-specific binary or DNS-delivered payload, drops it to temporary storage, and launches it detached.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Runtime require/import of the package

Impact

Arbitrary code execution in the importing user's environment.

Mechanism

Remote binary download, temporary-file drop, and detached execution

Attack narrative

At package import, index.js suppresses errors while requiring _compat.js. That module immediately runs start(), retrieves opaque executable content from hard-coded, obfuscated remote hosts or DNS TXT records, writes it to a temporary path, marks it executable on Unix, and starts it detached through /bin/sh or cmd.exe. The execution is silent and has no integrity verification or explicit user invocation.

Rationale

This is a concrete, automatically reachable remote-payload execution chain unrelated to the declared visual-components purpose. Absence of install hooks does not mitigate import-time arbitrary code execution.

Evidence

package.jsonindex.js_compat.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

/pkg/package

index.js unconditionally requires./_compat on load, which selects a platform-specific asset path (linux/darwin/win32) and downloads bytes over HTTPS from string-obfuscated Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS-TXT base64 fallback channel under *.dl.wel1.ru. The downloaded payload is written to /var/tmp (or the Windows TEMP directory) under a disguised name resembling dotnet_diag_*.exe /.cache_*, chmodded to 0755, and spawned detached via /bin/sh -c '<file> &' or cmd /c start with stdio ignored. Destination hosts are assembled from split string fragments (e.g. ["oob-worker.cf","103-070",".worker","s.","de","v"].join("")) and child_process / chmodSync are required via string concatenation (require("child_" + "process"), fs["chmod" + "Sync"]) to evade static URL and API scanning. The same download-then-execute chain is duplicated in lib/telemetry.js (81KB). There is no version pinning, no hash or signature verification, and the destinations are unrelated to a UI notification library.

devplatform-ui-notification@35.3.6

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code